Catcrafts/Crafter.Asset
Watch
2
0
Fork
You've already forked Crafter.Asset
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(glb): the code review's findings, and morph targets

Browse source 
Images (Crafter.Asset:Texture):
- LoadPNGFromMemory reads an image's size from its header before decoding
  and refuses more than 65535 a side or 2^28 pixels: stb's 16-bit PNG path
  sized its buffer in 32 bits and overflowed the heap from 2^29. LoadPNG
  reads its file and goes the same way. SizeFromMemory is public.
- A failure stb gives no reason for no longer passes NULL to std::string,
  and the reason is cleared before each decode, so it is never an older one.
- LoadPNG throws std::runtime_error for a file that doesn't load, which
  crafter-build's try/catch reports per file; without exceptions it is Fatal.

Bounds (Crafter.Asset:GLB):
- Load takes an optional decodeLimit, by default 1 GiB plus 64 bytes for
  each byte of the file. Vertices, indices and pixels are paid for before
  they are allocated, so primitives or images naming the same data can't
  exhaust memory.
- extras are written without recursion: deep nesting overflowed the stack.
- The skinned-joint check is O(vertices + nodes), not O(nodes x vertices).
- Load(path) reads the 12-byte header before the rest, and says why a path
  doesn't open.
- Chunk arithmetic is in 32 bits, as the header's is, ordered so that it
  can't wrap round.

Correctness:
- Indices are range-checked before they are narrowed to 32 bits, and whole
  numbers written as 24.0 read as integers.
- Missing tangents come from the UV set the normal texture samples, and a
  zero normal no longer makes them NaN.
- A file that requires an extension the loader doesn't implement is an
  error.
- Only PNG and JPEG are decoded; other formats (WebP, KTX2) stay empty, and
  no texture may use one. An image repeating another's bufferView is copied.
- Strips and fans become lists; points and lines come back empty.
- texCoord is 0 or 1, and every primitive whose material samples it has it.
- JOINTS_n and WEIGHTS_n pair up, the four heaviest influences are kept, a
  vertex without weight goes to its first joint, and a skinned node's mesh
  has joints in every primitive.
- The default scene exists, and its roots are distinct root nodes.
- Sampler enums are glTF's.

New:
- TEXCOORD_1, as uv1.
- Morph targets with the mesh's and nodes' weights; sparse accessors and
  ones without a bufferView; the meshes' extras; the BIN chunk.
- Images are TextureAsset<Vector<std::uint8_t, 4, 4>>; GlbRGBA8 is gone.

Tests: each of the above. The deep chain is timed against one a quarter as
deep instead of a 2 s clock, which flaked in debug builds; the byteStride
and chunk-length tests now fail when the check they test is removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jorijn van der Graaf 2026-10-31 03:25:12 +01:00
commit fbf3e7fc2e
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
4 changed files with 1468 additions and 400 deletions
Download patch file Download diff file Expand all files Collapse all files

103
interfaces/Crafter.Asset-Texture.cppm
View file

@ -6,6 +6,12 @@ module;
#include "../lib/stb_image.h"
#define STB_IMAGE_RESIZE_IMPLEMENTATION
#include "../lib/stb_image_resize2.h"
// stb keeps the reason for its last failure until the next one, and a few
// of its failures give none: cleared before each decode, the reason after a
// failure is that failure's or null, never an older one's.
void CrafterAssetClearStbiFailure() {
stbi__g_failure_reason = nullptr;
}
export module Crafter.Asset:Texture;
import :Compression;
import std;
@ -143,51 +149,110 @@ export namespace Crafter {
file.read(reinterpret_cast<char*>(pixels), sizeX * sizeY * sizeof(T));
}
// Decodes anything stb_image reads (PNG, JPEG, ...) to 8-bit RGBA, or
// to normalized floats when TT is a floating-point component type.
// Decodes anything stb_image reads (PNG, JPEG, TGA, BMP, ...) to 8-bit
// RGBA, or to normalized floats when TT is a floating-point component
// type. A file that doesn't decode throws std::runtime_error, which
// callers such as crafter-build catch to report the file; built
// without exceptions (wasm), there is nothing to catch, and it is
// Fatal.
template <typename TT>
static TextureAsset<T> LoadPNG(fs::path path) {
std::filesystem::path abs = std::filesystem::absolute(path);
int sizeX;
int sizeY;
unsigned char* data = stbi_load(abs.string().c_str(), &sizeX, &sizeY, nullptr, 4);
if (data == nullptr) {
Compression::Fatal(std::format("LoadPNG: {}: {}", abs.string(), stbi_failure_reason()));
// Read whole and decoded from memory, so that the size checked
// before decoding is the size of the bytes that are decoded.
std::error_code error;
if (!fs::is_regular_file(abs, error)) {
Fail(std::format("LoadPNG: {}: {}", abs.string(), error ? error.message() : "not a file"));
}
if (!FitsSize(sizeX, sizeY)) {
stbi_image_free(data);
Compression::Fatal(std::format("LoadPNG: {}: {}x{} is more than a texture's 65535 a side", abs.string(), sizeX, sizeY));
const std::uintmax_t size = fs::file_size(abs, error);
if (error) Fail(std::format("LoadPNG: {}: {}", abs.string(), error.message()));
if (size > kMaxEncoded) Fail(std::format("LoadPNG: {}: {} bytes is more than stb_image reads", abs.string(), size));
std::vector<std::byte> encoded(static_cast<std::size_t>(size));
std::ifstream file(abs, std::ios::binary);
if (!file.read(reinterpret_cast<char*>(encoded.data()), static_cast<std::streamsize>(encoded.size()))) {
Fail(std::format("LoadPNG: {}: can't read it", abs.string()));
}
return FromRGBA8<TT>(data, sizeX, sizeY);
std::expected<TextureAsset<T>, std::string> tex = LoadPNGFromMemory<TT>(encoded);
if (!tex) Fail(std::format("LoadPNG: {}: {}", abs.string(), tex.error()));
return std::move(*tex);
}
// LoadPNG from an image that is already in memory, e.g. one embedded
// in a GLB. An image that doesn't decode comes back as an error value
// rather than a Fatal: the caller is reading a larger asset and can
// say which part was bad.
// rather than an exception or a Fatal: the caller is reading a larger
// asset and can say which part was bad. One too large for a texture
// is turned down from its header, before anything is decoded.
template <typename TT>
static std::expected<TextureAsset<T>, std::string> LoadPNGFromMemory(std::span<const std::byte> encoded) {
const auto size = SizeFromMemory(encoded);
if (!size) return std::unexpected(size.error());
int sizeX;
int sizeY;
CrafterAssetClearStbiFailure();
unsigned char* data = stbi_load_from_memory(reinterpret_cast<const stbi_uc*>(encoded.data()),
static_cast<int>(encoded.size()), &sizeX, &sizeY, nullptr, 4);
if (data == nullptr) {
return std::unexpected(std::string(stbi_failure_reason()));
return std::unexpected(FailureReason());
}
if (!FitsSize(sizeX, sizeY)) {
stbi_image_free(data);
return std::unexpected(std::format("{}x{} is more than a texture's 65535 a side", sizeX, sizeY));
return std::unexpected(std::format("{}x{} decoded from a header of {}x{}", sizeX, sizeY, size->first, size->second));
}
return FromRGBA8<TT>(data, sizeX, sizeY);
}
// The width and height LoadPNGFromMemory would decode an image to,
// read from its header alone, or why it wouldn't: an image it can't
// read, or one too large for a texture.
static std::expected<std::pair<std::uint32_t, std::uint32_t>, std::string> SizeFromMemory(std::span<const std::byte> encoded) {
if (encoded.size() > kMaxEncoded) {
return std::unexpected(std::format("{} bytes is more than stb_image reads", encoded.size()));
}
int sizeX;
int sizeY;
int components;
CrafterAssetClearStbiFailure();
if (!stbi_info_from_memory(reinterpret_cast<const stbi_uc*>(encoded.data()), static_cast<int>(encoded.size()),
&sizeX, &sizeY, &components)) {
return std::unexpected(FailureReason());
}
if (!FitsSize(sizeX, sizeY)) {
return std::unexpected(std::format("{}x{} is more than a texture takes: 65535 a side, {} pixels in all", sizeX, sizeY, kMaxPixels));
}
return std::pair<std::uint32_t, std::uint32_t>(sizeX, sizeY);
}
private:
// sizeX and sizeY hold 16 bits.
static bool FitsSize(int sizeX, int sizeY) {
return sizeX <= std::numeric_limits<std::uint16_t>::max() && sizeY <= std::numeric_limits<std::uint16_t>::max();
// stb_image takes an encoded image's length as an int.
static constexpr std::uintmax_t kMaxEncoded = std::numeric_limits<int>::max();
// sizeX and sizeY hold 16 bits, and stb_image's arithmetic 32: its
// 16-bit PNG decoding sizes a buffer of 8 bytes a pixel in an
// unsigned int, which wraps round from 2^29 pixels. 2^28 is
// 16384x16384, 1 GiB of RGBA8.
static constexpr std::uint64_t kMaxPixels = std::uint64_t{1} << 28;
static bool FitsSize(std::uint64_t sizeX, std::uint64_t sizeY) {
return sizeX <= std::numeric_limits<std::uint16_t>::max() && sizeY <= std::numeric_limits<std::uint16_t>::max()
&& sizeX * sizeY <= kMaxPixels;
}
// stb_image's reason for the failure just now. CrafterAssetClearStbiFailure
// before the call makes it this failure's, but some failures give
// none.
static std::string FailureReason() {
const char* reason = stbi_failure_reason();
return reason != nullptr ? reason : "corrupt image";
}
[[noreturn]] static void Fail(const std::string& message) {
#if __cpp_exceptions
throw std::runtime_error(message);
#else
Compression::Fatal(message);
#endif
}
// Converts stb's RGBA8 buffer, classifies its opacity and frees it.